https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338609#M100407 <P>Trying to combine in a single table the all time average of a field value (data feed start is 10/19) vs its average from a time picked range:</P> <P>search foo earliest=10/19/2017:0:0:0 <BR /> | stats avg(rpm_average) as ALLTIME_AVG by interfaces <BR /> | eval ALLTIME_AVG=ALLTIME_AVG/1000 <BR /> | eval ALLTIME_AVG=round(ALLTIME_AVG,2) <BR /> | append <BR /> [ search foo<BR /> | stats avg(rpm_average) as TIMEPICKED_AVG by interfaces <BR /> | eval TIMEPICKED_AVG=TIMEPICKED_AVG/1000<BR /> | eval TIMEPICKED_AVG=round(TIMEPICKED_AVG,2)] <BR /> | table interfaces ALLTIME_AVG TIMEPICKED_AVG</P> <P>I am getting the below result but would like to combine rows (tried to MVDEDUP interfaces but did not work). Also, would like to add another column for difference.</P> <P>Thank you in advance!</P> <P><IMG src="https://community.splunk.com/storage/temp/219634-sample.jpg" alt="![alt text][1]" /></P> Tue, 29 Sep 2020 16:31:21 GMT christopheryu 2020-09-29T16:31:21Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338609#M100407 <P>Trying to combine in a single table the all time average of a field value (data feed start is 10/19) vs its average from a time picked range:</P> <P>search foo earliest=10/19/2017:0:0:0 <BR /> | stats avg(rpm_average) as ALLTIME_AVG by interfaces <BR /> | eval ALLTIME_AVG=ALLTIME_AVG/1000 <BR /> | eval ALLTIME_AVG=round(ALLTIME_AVG,2) <BR /> | append <BR /> [ search foo<BR /> | stats avg(rpm_average) as TIMEPICKED_AVG by interfaces <BR /> | eval TIMEPICKED_AVG=TIMEPICKED_AVG/1000<BR /> | eval TIMEPICKED_AVG=round(TIMEPICKED_AVG,2)] <BR /> | table interfaces ALLTIME_AVG TIMEPICKED_AVG</P> <P>I am getting the below result but would like to combine rows (tried to MVDEDUP interfaces but did not work). Also, would like to add another column for difference.</P> <P>Thank you in advance!</P> <P><IMG src="https://community.splunk.com/storage/temp/219634-sample.jpg" alt="![alt text][1]" /></P> Tue, 29 Sep 2020 16:31:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338609#M100407 christopheryu 2020-09-29T16:31:21Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338610#M100408 <P>Do it at the same time. Much more efficient.</P> <PRE><CODE> my search | eval period_average =case( test that _time is in the period you want, rpm_average) | stats avg(rpm_average) as ALLTIME_AVG, avg(period_average) as TIMEPICKED_AVG by interfaces </CODE></PRE> <HR /> <P>FYI, If there were a reason not to do the above, you could just do this at the end...</P> <PRE><CODE>| stats values(*) as * by interfaces </CODE></PRE> Mon, 30 Oct 2017 22:25:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338610#M100408 DalJeanis 2017-10-30T22:25:05Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338611#M100409 <P>Just add into your search.</P> <P>YOUR_SEARCH | stats values(ALLTIME_AVG ) as ALLTIME_AVG values(TIMEPICKED_AVG) as TIMEPICKED_AVG by interfaces</P> Tue, 29 Sep 2020 16:27:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338611#M100409 kamlesh_vaghela 2020-09-29T16:27:03Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338612#M100410 <P>thank you.</P> Thu, 02 Nov 2017 15:48:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338612#M100410 christopheryu 2017-11-02T15:48:00Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338613#M100411 <P>2nd one worked, pretty much the same as kamlesh's. Thank you.</P> Thu, 02 Nov 2017 15:48:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-all-time-average-of-a-field-value-vs-average-for/m-p/338613#M100411 christopheryu 2017-11-02T15:48:11Z